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The Two- Way Wiretap Channel: Achievable 
Regions and Experimental Results 

Aly El Gamal, O. Ozan Koyluoglu, Moustafa Youssef, and Hesham El Gamal 

Abstract 

This work considers the two-way wiretap channel in which two legitimate users, Alice and Bob, wish to exchange 
messages securely in the presence of a passive eavesdropper Eve. In the full-duplex scenario, where each node can 
transmit and receive simultaneously, we obtain new achievable secrecy rate regions based on the idea of allowing the 
two users to jointly optimize their channel prefixing distributions and binning codebooks in addition to key sharing. 
The new regions are shown to be strictly larger than the known ones for a wide class of discrete memoryless and 
Gaussian channels. In the half-duplex case, where a user can only transmit or receive on any given degree of freedom, 
we introduce the idea of randomized scheduling and establish the significant gain it offers in terms of the achievable 
secrecy sum-rate. We further develop an experimental setup based on a IEEE 802.15.4-enabled sensor boards, and 
use this testbed to show that one can exploit the two-way nature of the communication, via appropriately randomizing 
the transmit power levels and transmission schedule, to introduce significant ambiguity at a noiseless Eve. 

I. Introduction 

In a pioneering paper ||2|, Shannon established the achievability of perfectly secure communication in the presence 
of an eavesdropper with unbounded computational complexity. However, the necessary condition for perfect secrecy, 
i.e., that the entropy of the private key is at least as large as that of the message, appears to be prohibitive for most 
practical applications. In jS), Wyner revisited the problem and proved the achievability of a positive secrecy rate over 
a degraded discrete memoryless channel, via a key-less secrecy approach, by relaxing the noiseless assumption and 
the strict notion of perfect secrecy employed in ||2l. Wyner's results were later extended to the Gaussian and broadcast 
channels in [4J and [5J, respectively. In ||6l, Maurer showed how to exploit the presence of a public discussion 
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channel to achieve positive secrecy over the one way wiretap channel even when the eavesdropper channel is less 
noisy than the legitimate one. In Q, the authors considered a more practical feedback scenario where the noiseless 
public channel is replaced by receiver feedback over the same noisy channel. Under this assumption, it was shown 
that the perfect secrecy capacity is equal to the capacity of the main channel in the absence of the eavesdropper 
for full-duplex modulo-additive discrete memoryless channels. More interestingly, [7| established the achievability 
of positive secrecy rates, even under the half-duplex constraint where each feedback symbol introduces an erasure 
event in the main channel. 

Our work generalizes this line of work by investigating the fundamental limits of the two-way wiretap channel, 
where Alice and Bob wish to exchange secure messages in the presence of a passive eavesdropper Eve. It is easy to 
see that the one way channel with feedback considered in Q is a special case of this model. Using the cooperative 
channel prefixing and binning technique proposed in IS), ||9l, along with an innovative approach for key sharing 
between Alice and Bob, we first derive an inner bound on the secrecy capacity region of the full-duplex discrete 
memoryless two-way wiretap channel. By specializing our results to the additive modulo-2 and Gaussian channel, 
our region is shown to be strictly larger than those reported recently in the literature IfTOll . IfTTII . |fT3]| . The gain 
can be attributed to the fact that we allow both nodes to simultaneously send secure messages when the channel 
conditions are favorable. We then proceed to the half-duplex setting where each node can only transmit or receive 
on the same degree of freedom. Here, we introduce the concept of randomized scheduling for secrecy, whereby 
Alice and Bob send their symbols at random time instants to maximally confuse Eve at the expense of introducing 
collisions and erasure events in the main channel. Remarkably, this approach is shown to result in significant 
gains in the achievable secure sum rate, as compared with the traditional deterministic scheduling approach. In the 
Gaussian scenario, we show that the ambiguity at Eve can be further enhanced by randomizing the transmit power 
levels. 

Inspired by our information theoretic foundation, we develop an IEEE 802.15.4 testbed to estimate the ambiguity 
at the eavesdropper in near field wireless sensor networks where the distance between the legitimate nodes is 
significantly smaller than that to the potential eavesdropper A representative scenario corresponds to Body Area 
Networks (BAN) which are being considered for a variety of health care applications. Here, the sensor nodes are 
mounted on the body, and hence, any potential eavesdropper is expected to be at a significantly larger distance 
from each legitimate node. Clearly, ensuring the confidentiality of the messages exchanged between sensors is an 
important design consideration in this application. Assuming an eavesdropper equipped with an energy classifier, 
analytical and experimental results that quantify the achievable secrecy sum rate under a two dimensional path 
loss model are derived. However, it is worth noting that we do not address the issue of implementing the classical 
wiretap code IJI in this work. Overall, these results establish the gain offered by the two-way randomization concept 
and establish the feasibility of our approach in realistic scenarios. 

It is worth noting that similar settings to the one considered in this work, exist in the literature. In particular, the 
authors in |15| consider a binary erasure block-fading channel where the nodes are placed according to a similar 
geometric model to that in Section IIVI and provide analytical and experimental results for the secrecy outage 
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probabilities for frames of different sizes, lfT4l considers an extension of the two-way wiretap channel where the 
untrusted eavesdropper may be used to relay messages between the two users. Also, lfT6l considers the two-way 
wiretap channel with a strong secrecy constraint, where the mutual information leakage to the eavesdropper, rather 
than the leakage rate (defined in Section is required to vanish in the limit of the number of channel uses. 

The rest of the paper is organized as follows. In Section [III we develop an achievable secrecy rate region for the 
full-duplex discrete memoryless two-way wiretap channel, and speciahze the result to the additive modulo-2 and 
Gaussian channel. Section |III] is devoted to the half-duplex scenario where the concept of randomized scheduling is 
introduced. Our practical setting, using the TinyOS-enabled sensor boards, is described in Section |IVl The analytical 
and experimental results of this section establish the feasibility of our approach in near field wireless sensor network 
applications. Finally, we offer some concluding remarks in Section |V] To enhance the flow of the paper, the detailed 
proofs are collected in the appendices. 



In the full-duplex scenario, each of the two legitimate terminals is equipped with a transmitter and a receiver 
that can operate simultaneously on the same degree of freedom. The two users intend to exchange messages in 
the presence of a (passive) eavesdropper More specifically, the i*'' user wishes to transmit a secret message Wi, 
selected from a set of equiprobable messages M.i = {!,..., Afi}, to the other user, in n channel uses, where 
1 = 1,2. For message Wi, a codeword Xi(wi) = . . . , Xi{n)} is transmitted at a rate Ri = i log2 Mi- The 

i*'' decoder employs a decoding function 4>i{.) to map the received sequence to an estimate Wi of Wi. The 
two-way communication is governed by reliability and secrecy constraints. The former is measured by the average 
probabihty of error. 



where Z = {Z{1), . . . , Z{n)} is the observed sequence at the eavesdropper. Here, we focus on the perfect secrecy 
rate region, where the leakage rate is made arbitrarily small ID, as formalized in the following. 

Definition 1: The secret rate tuple (i?i,i?2) is achievable for the two-way wiretap channel, if for any given 
e > 0, there exists an {n, Mi, M2, Pe,i, Pe,2, Ln) code such that. 



II. Full-Duplex Channels 




whereas the latter is quantified by the mutual information leakage rate to the eavesdropper L, i.e.. 



Ln = -I{WuW2;Z), 



Ri 



R2 



- log2 Ml 
n 

- l0g2 M2 



max(Pe,ii-Pe,2) 



< 



e 



L. 



'n 



< 



for sufficiently large n. 
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We note that the last condition implies that (see, e.g., |j9] Lemma 15]) 

-i?(VK,|Z) >Ri-e for i = 1,2. 



n 



The secrecy capacity region is defined as the set of all achievable secret rate tuples (i?i,i?2) and is denoted 
by . Throughout the sequel, we will use the following shorthand notation for probability distributions: P{x) = 
P{X = x), P{x\y) = P{X = x\Y = y), and P{x.y) ^ P{X = x,Y ^ y), where X and Y denote arbitrary 
random variables. We will also use log(.x) to denote log2(a;), and [a]+ to denote max(a, 0). Furthermore, for the 
full-duplex discrete memoryless two-way channel with an external passive eavesdropper (DM-TWC-E), we will use 
the calligraphic letters Xi and X2 to denote the discrete input finite alphabets for user 1 and user 2, respectively, 
and 3^1, 3^2, and Z, to denote the output alphabets observed at the decoders of user 1, user 2, and the eavesdropper, 
respectively. The channel is given by P{yi,y2, z\xi,X2) and is memoryless in the following sense. 



We further assume all channel state information to be available at all nodes. Our general achievable region is 
obtained via a coding scheme inspired by 191 where the codewords Ci and C2 are drawn from the two binning 
codebooks, and passed on to the two respective prefix channels. To maximize the ambiguity at Eve, both the binning 
codebooks and channel prefixing distributions are jointly optimized. In addition, the proposed scheme involves key 
sharing with a block encoding technique to facilitate the secrecy generation. In particular, the key received from 
the other user during the previous block is used in a one time pad scheme |17| to transmit additional secret bits. 
The codeword consisting of the XOR of the message and the key serves a) as a cloud center in the superposition 
coding and b) as an additional randomization for the binning codebook. The following result characterizes the set 
of achievable rates using our coding scheme. 

Theorem 1: The proposed coding scheme achieves the region TZ for the full-duplex DM-TWC-E. 



where V denotes the set of all joint distributions of the random variables Q, Ui, U2, Ci, C2, Xi, and X2 satisfying 

P(g, Ml, W2, ci, C2, Xi, X2) = Piq)Piui\q)P{ci\ui)P{xi\ci)Piu2\q)P{c2\u2)Pix2\c2) 
and TZ{p) is the closure of all rate pairs = i?" + i?J + R°, R2 — R2 + i?2 + ^2)' ^i'^^ non-negative tuples 



^(yiW,2/2(<),^(t)|x*i,x*,y*"\y*-\z*-i) = P(yi(i),2;2(t),2(t)|2:i(t),a;2(t)). 



n = closure of I |J n{p) > C C^, 
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(R^, RlR1,Rf,R^,RI,RlR^) satisfying 

Rl+R'l + RI + Rf < I{Ci;Y2\X2,Ui,Q) (1) 
R'^ + Rl+R'l+RI + Rf < IiUuCuY2\X2,Q) (2) 

R'2+R2+R2+R2 < I{C2;Yi\Xi,U2,Q) (3) 

R^ + RI + R'2+R°2+R^2 < I{U2,C2;Y,\X,,Q) (4) 

R° + Rf < I{Ci;Z\Ui,U2,C2,Q) (5) 

R2 + R2 < I{C2;Z\Ui,U2,Ci,Q) (6) 

Rl + Rl + R°2 + R^2 = I{Ci,C2;Z\Ui,U2,Q) (7) 

R't + Rl < i?2 (8) 

R2+R2 < Ri (9) 

Proof: Please refer to Appendix lAl ■ 
For i = 1,2, Rf denotes the rate of physically secure transmission for user i. i.e., the part of message Wi that is 
secured using cooperative binning and channel prefixing only, i?f denotes the rate of key transmission from user i 
to the other user, R° denotes the rate of transmission of the open part of message Wi that is secured using the secret 
key received from the other user in the previous block. The classical wiretap code |3j requires sacrificing part of the 
rate available for reliable communication, to exploit the secrecy advantage offered by the physical channel (in our 
case, the equivalent channel after inserting the channel prefix) in order to hide the message from the eavesdropper. 
The aforementioned part equals R° + Rf for user i. Note that the eavesdropper may be able to decode this part 
of message Wi, including the open part, but that will not violate the secrecy condition since this part is secured 
by the secret key received from the other user The possibiUty of using a superposition code 1 1 8 1 to transmit the 
physically secured message is allowed, where all nodes - including the eavesdropper - can identify the position of 
the cloud center, however, the part of the message conveyed through the cloud center is secured through the secret 
key received from the other user in the previous block, and in this case the rate of transmission for this part is 
given by Rf. The random variables Q and U denote the time sharing random variable and the cloud center of the 
superposition code, respectively. 

Inequalities ([Hi- Q follow from the reliable communication constraint, and the conditions in Q- ^ ensure that 
enough randomization is inserted through the wiretap code into the multiple access channel from the two legitimate 
nodes to the eavesdropper, such that the secrecy constraint is satisfied. Finally, the conditions in (O- (|9|l follow 
from the fact that the entropy of the part of the message that is secured using the secret key received from the 
other user is bounded by the entropy of that key 0. Note that the role of key sharing evident from the above 
inequalities, is not to increase the sum rate, but to give complete freedom in distributing the the secrecy advantage 
offered by the two-way wiretap channel (after inserting the channel prefixes) between the two users. 

Remark 1: The proposed coding scheme can be used to exchange open messages (secured using the secret key) 
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in addition to the physically secure ones between Alice and Bob, even through the cloud center of the superposition 
code. More Specifically, the rate i?" can be split into an open part and a physically secured part i?"*. Let 
jjseciet ^jjj R°^™ be the secret and open message rates of transmitter i = 1, 2. Then, the proposed scheme readily 
achieves the four-dimensional rate region given by the closure of the union (over all input probability distributions) 
of the set of rate tuples 

[Iti — 111 ' ^1 ' ^1 I ^1 — ^1 ' ^1 1 ^2 — ^2 ' ^2 ' ^2 I ^2 — ^2 ' ^2 /i 

with the non-negative rate tuples R\° , RlR1,Rf, R^',R^°, R^,R^,R^) satisfying ©-0 with i?^ = i?^" + 

R2 = RT + RT and RY + Rl < , R^ + R2 < R\- 

One can immediately see that the region TZ does not lend itself to simple computational approaches. Therefore, 
the rest of the section will focus primarily on the following sub-region TZ^ . 

Theorem 2: For the full-duplex DM-TWC-E, 

= closure of \ [_] n^{p) > C 7^ C C^, 

where denotes the set of all joint distributions of the random variables Q, Ci, C2, Xi, and X2 satisfying 

P{q,Ci,C2,Xi,X2) = P{q)P{ci\q)P{c2\q)P{xi\ci)P{x2\c2) 
and TZ^{p) is the closure of all non-negative rate tuples {Ri,R2) satisfying 

Rl < I{Ci;Y2\X2,Q) 
R2 < /(C2;Yi|Xi,Q) 
R1 + R2 < I{Ci;Y2\X2,Q) + I{C2;Y,\Xi,Q)~I{Ci,C2;Z\Q). 

Proof: Please refer to Appendix iBl ■ 
Note that the above region, TZ^, is achievable without the need to use superposition coding, hence it is not clear 
to us whether the use of a superposition code is needed or not. (Please refer to Remark |2] in Appendix IbI ) 

A. The Modulo-Two Channel 

To shed more light on the structural properties of our achievable rate region, we now consider the special case 
of the full-duplex modulo-2 two-way wiretap channel described by the following set of input-output relations. 

Yi = XieX2®Ni 

Y2 = Xi®X2eN2 

Z = Xi©X2©Ne, 

where Ni= {iVi(l), . . . , iVi(7i)}, N2= {iV2(l), • • ■ , ^2(n)}, and Ne= {N ^{1) , . . . , N e{n)} are the additive binary 
noise vectors impairing Alice, Bob, and Eve, respectively. The corresponding transition probabilities are given by: 
P{Ni{t) = 1) = ei, P{N2{t) = 1) = €2, and P{Ne{t) ^ 1) — ee for i — 1, . . . ,n. The secrecy capacity region is 
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denoted by C^*^. In this special case, the transmitted codeword reduces to the modulo-2 sum of a binning codeword 
and an independent prefix noise component, i.e., 

Xi = Ci®Ni 

X2 = C2®N2, 

where Ni= {iVi(l), . . . , Ni{n)}, N2= {iV2(l), . . . , N2{n)} are the prefix noise vectors transmitted by AHce and 
Bob. The components of these vectors are generated according to i.i.d. distributions with the following marginals: 
P{Ni{t) = 1) = ei, P{N2{t) = 1) = £2 for i ~ 1, . . . ,n. The binning codebooks, on the other hand, are generated 
according to a uniform i.i.d. distribution. We further define the following crossover probabilities to describe the 
cascade of the prefix and original channels. 

-P(yi 7^ C2IC2) = ei ^ ei(l - £2) + £2(1 - ei) 
P{y2^ci\ci) = £2 = £2(1 ~ ei) + ei(l - £2) 

-P(z 7^ (Cl © C2)|C1, C2) = £e ^ £e(l - £12) + £12(1 - £e) 

where, £12 = £2(l~£i)+£i(l~£2)- The need for the channel prefixes is evident in the case when the physical channel 
does not offer a secrecy advantage. For example, for the case when all channels are noiseless (£1 = £2 = £e = 0), 
no positive secrecy rates are achievable with only binning and key sharing. However, it is easy to see that the rates 
i?2) — (1, 0) and (0, 1) are achievable with a choice of (£1, £2) = (0, 0.5) and (0.5, 0), respectively. Using the 
above notation, the achievable region in Theorem |2] reduces to the region TZ^^^ defined as follows. 
Corollary 1: For the full-duplex modulo-2 two-way wiretap channel 

^ closure of the convex hull of J |J TZ^^^{p) I C C^^^ 

where 7?^*^ is defined as, 

pFMA {(e-i,e2):0<£-i,£2<l}, 
and TZ^'^^p) is the closure of all non-negative rate tuples (i?i,i?2) satisfying 

Ri < l-Hih) 

i?2 < l-i?(£i) 

i?l+i?2 < l+i/(£e) -H(£i) -i/(£2). 

Moreover, our achievable region contains the two corner points of the secrecy capacity region, namely 

max Ri = 1 — H(ei), and 
(i?.i,o)ec 



max i?2 = 1 — ^^(£2)- 



Proof: Please refer to Appendix |C] 
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A few remarks are now in order. 

1) The region in Corollary [T] is strictly larger than the ones reported in ifTOl . ifTTl . as demonstrated by the 
numerical results of Fig. [T] Here we compare our region with the one achieved by random binning and key 
sharing only, and channel prefixing only ( [10 Section 5]). The region reported in ifTTl Theorem 2] can be 
achieved via binning without key sharing, hence, is a strict sub-region of Corollary [T] 

2) The corner points of the region in Corollary [T] is achieved by random binning and key sharing only if 
Ee > max(ei, 62), and achieved by only channel prefixing if eg < min(ei, £2). 

3) The previous result identifies the separate role of channel prefixing and binning. First, channel prefixing is 
used to create an advantage of Alice and Bob over Eve via the joint optimization of li and £2- Then, the 
binning codebooks are used to transform this advantage into a secrecy gain for the two terminals. 

B. The Gaussian Channel 

In the full-duplex Gaussian setting, the channel is given by, 

Yi = VsITXi + X2 + Ni 

Y2 = Xi + ^/g22^2 + N2 

Z = ^/gZXl + ^5^X2 + Ne 

where gn, g22, gei, and ge2 are channel coefficients, Ni, N2, and Ng are i.i.d. noise vectors with zero-mean unit- 
variance white Gaussian entries at user 1, user 2, and Eve, respectively. We assume the average power constraints 
given by 

1 " 

-y(X,(t))2 <p„ for I = 1,2. 

t=i 

The secrecy capacity of this channel is denoted by C^^. 

We define 7(x) = i log(l + x) and h{X) = — J fx{x) log fx{x)- The prefix to the channel from user 1 to user 2 
is an additive white Gaussian noise channel with i.i.d. noise Ni ^ J^{0, p"), where the allocated power for user 1 is 
distributed among the signal Ci and the artificial noise iVi. More specifically, Ci ^ A/^(0, ), and pi + p'l = pi — e, 
and the transmitted signal Xi = Ci + Ni. By the weak law of large numbers, J2^=ii-^ii^))^ — > pi — e as 
n — > 00. X2 is constructed similarly to obtain the following. 

Corollary 2: For the full-duplex Gaussian two-way wiretap channel, the achievable rate region TZ^'~^ is given by, 
n^G A closure of the convex hull of < U n^^{p) \ C C^^, 
where 'P^'~^ is defined as, 

T'^^ = {{PIP1.P2,P2) ■■Pl+Pl< PI.P2 +P2< P2}, 

and TZ^'~^{p) is the closure of all non-negative rate tuples (_Ri,i?2) satisfying 
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P2 



R1+R2 < 7 



■7 



P2 



7 



Pl9el + P29e2 



1 + p'lV V 1 + P2 / V 1 + Pl9el + P2 9e2 , 

Proof: The proof follows by extending Theorem|2]to continuous random variables, where we also set |Q| = 1, 
and use the convex hull operation. The tools needed to extend the probability of error and equivocation analysis 
are already available in the literature[e.g. see ifTTl and lfT2l l. ■ 
In Fig. |2l we compare the region of Corollary |2] with the following special cases: 1) Both users implement 
cooperative binning and key sharing without channel prefixing and 2) One of the users implements individual 
secrecy encoding |[3l, the other helps only with channel prefixing. The same trends of the modulo-2 case are 
observed here except for the fact that channel prefixing does not achieve the two extreme points of V/^ . We note 
that the region reported in ifTTl Theorem 2] can be achieved by implementing binning without key sharing, and 
hence, is a sub-region of Corollary |2l The scheme in fTTl Section V] is either binning only at both users, or binning 
at one user and channel prefixing (jamming) at the other user The resulting regions are subregions of Corollary |2] 
(the first one is a subregion of the dashed region and the second one is the dotted region in Fig. 2.). Next, we 
compare our results with that of fT3|. Let, 



iti — max 

ae[0,l] 



7(Pi) 



7 



9e\P\ 



1 



9e2P2 



1 — a 



a 



7 (P2) - 7 



9e-2P2 



1 



5elPl 



i?2 is obtained by reversing the indices above. Then, the achievable rate region proposed in lfT3l is given by the 
convex hull of the following three points: 

[0,0],[i?J,0],and [0,i?;]. 

We note that the region VJ'^ given in Corollary |2] strictly includes this one. (The proof of the inclusion part is 
given in Appendix ID]) Fig. [3] demonstrates the fact that the inclusion can be strict. The same figure also includes 
the achievable region obtained by backward key sharing only. In this scheme, users utilize only the one time pad 
scheme in a time division manner where the node first receives a secret key and then uses it to secure the message. 
The corresponding region can be described as follows. Let 



R\ = max min < aj(pi), (1 

ae[0,l] 



7(P2) -7 



9e2P2 



1 



9elPl 



r\ is obtained by reversing the indices above. Then backward key sharing achieves the convex hull of the following 



three points: 



[0,0], [i?|,0],and [0,i?^] 



Note that, this is a subregion of TZ (given in Theorem [T]), in which C2 is used to transmit secret key from user 
2 to user 1, and Ui is utilized to transmit secret message in a one time pad fashion. Comparing i?| and R\ in 
Fig. [3] we can see that this scheme can achieve higher rates than the ones reported in ifTSl . We also remark that 
this example is an evidence of the fact that the region in Theorem [T] strictly includes that of Theorem ID (That is. 
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P*{yi,y2,z\xi,x2) 



TZ^ C 7?. as i?| ^ TZ^ but i?| e 7?. for the Gaussian channel.) In summary, the region in Theorem [T] includes all 
the stated regions as special cases. 

III. Half-Duplex Channels 

Our first step is to define the following equivalent full-duplex model for the half-duplex channel. 

Definition 2: For a given half-duplex channel governed by P(y2, P{yi, z\x2), P{z\xi, X2), and P{yi)P {1/2) P{z) 

an equivalent full-duplex channel P* {yi,y2, z\xi, X2) is defined as follows. 

We allow the channel inputs to take the values in X* = {Xi, ?}, where ? represents the no transmission event. 
Similarly the channel outputs take values in 3^* = {3^^, ?}, where ? represents the no reception event (due to the 
half-duplex constraint). Then, for the symbol time, the full-duplex channel P* {yi,y2, z\xi, X2) is said to be in 
one of the following states: 

1) xi{t) € Xi, X2{t) —1 : User 1 is transmitting, user 2 is in no transmission state. 

2) xi{t) =?, X2{t) e X2 '■ User 1 is in no transmission state, user 2 is transmitting. 

3) xi{t) S Xi, X2{t) e X2 : Both users are transmitting. 

4) xi{t) —7, X2{t) =? : Both users are in the no transmission state. 
Accordingly, the channel P* {yi,y2, z\xx,X2) is given by 

P{y2,z\xi,X2 =l)l{y^'f}, for state 1 
P(yi,z\xi =?,.T2)l{y2/?}, for state 2 
P(z|a;i, X2)l{yi,7}l{j^2^7}, for state 3 
P{yi-,V2,z\xi,'!,X2 =1), for state 4, 
where l{x,y} = 1, if a; = y and l{x,y} = 0, if a; 7^ y, and P[y2,z\xi,X2 =?), P{yi,z\xi =?, 2:2), P{z\^i,X2), 
and P{yi^y2, z\xi —7,X2 =?) are given by the half-duplex channel. 

Using this definition and our results for the full-duplex channel, we obtain the following result. 
Corollary 3 (Deterministic Scheduling): The following region TZ^^^ is achievable for the half-duplex DM- 
TWC-E with deterministic scheduling. 

7^^-^ ^ the closure of J |J n"-°{P) 

where denotes the set of all joint distributions of the random variables Q, Ci, C2, Xi, and X2 satisfying 

P(g,Ci,C2,Xi,X2) = P{q)P{ci\q)P{c2\q)P{xx\ci)P{x2\c2), 
TZ^~^{P) is the closure of all non-negative rate tuples {Ri,R2) satisfying 

Ri < FalQ, state 1) 

R2 < Fs2/(C2;ri|g,state 2) 
R1+R2 < F.i [/(Ci;r2|Q, state 1) -/(Ci;Z|Q, state 1)] + 

+P.2[/(C2;Yi|g, state 2) - /(C2; Z|Q, state 2)] + , 
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and the channel is given by P*{y 1,1/2, z\xi,X2) as defined in ( fTOl l. 

Proof: The proof follows by Theorem [T] with the channel given by P* {yi,y2, z\xi, X2)- In each block we 
randomly select a state S = k with probability Pg^k, and replace Q by {Q, S}, where the random sequence s 
represents the channel states (and given to all nodes). The achievable region can be represented with the given 
description, where the inputs are chosen such that we only utilize state 1 and 2 as the states 3 and 4 do not increase 
the achievable rates. ■ 

The previous region is achievable with a deterministic scheduling approach whereby the two users Alice and 
Bob a-priori agree on the schedule. Consequently, Eve is made aware of the schedule. Now, in order to further 
confuse the eavesdropper, we propose a novel randomized scheduling scheme whereby, in each channel use, user 
i will be in a transmission state with probability Pi. Clearly, this approach will result in collisions, wasting some 
opportunities for using the channels. However, as established shortly, the gain resulting from confusing Eve about 
the source of each transmitted symbol will outweigh these inefficiencies in many relevant scenarios. To simplify 
our derivations, we assume that all the nodes can identify perfectly state 4 (no transmission state). Furthermore, 
we also give Eve an additional advantage by informing her of the symbol durations belonging to state 3, and as 
a result we have the term —PiP2l{Ci, C2; Z\Q, state 3) in the sum rate constraint below. These assumptions are 
practical in the Gaussian channel, where the users can use the received power levels to distinguish these states. The 
following result characterizes the corresponding achievable region. 

Corollary 4 (Randomized Scheduling): The region TZ^ is achievable for the half-duplex DM-TWC-E with ran- 
domized scheduling. 

TZ" = closure of < [j n"{P)\ , 

{Pev" ,o<Pi,P2<i J 

where denotes the set of all joint distributions of the random variables Q, Ci, C2, Xi, and X2 satisfying 

P{q,ci, 02, XUX2) = P{q)Pici\q)Pic2\q)Pixi\ci)Pix2\c2), 

TZ^ {P) is the closure of all non-negative rate tuples (i?i,i?2) satisfying 

Ri < Pi{l-P2)I{Ci;Y2\X2,Q, state 1) 

R2 < {1- Pi)P2l{C2;Yi\Xi,Q,state2) 

R1+R2 < Piil- P2)IiCi;Y2\X2,Q, state 1) + (1 - ^1)^2/(^^2; nl^i, Q, state 2) 

-PiP2l{Ci,C2;Z\Q, state 3) - (Pi(l - P2) + (1 - Pi)P2)I{Ci,C2; Z\Q, state 1 or 2), 

and the channel is given by P* {yi,y2, z\xi,X2) as defined in ( fTOl l. 

Proof: Please refer to Appendix |E] ■ 
Similar to the full-duplex scenario, we now specialize our results to the modulo-2 case. We model this channel 
as a ternary input channel where the third input corresponds to the no-transmission event. This way, the three 
nodes can identify the symbol intervals when no one is transmitting. Therefore, those symbols will be identified 
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and erased, and the crossover probabiHties corresponding to the other three states are given by, 
P{z 7^ cijonly user 1 is transmitting) = €ei — ee(l — ei) + — Ce) 
P{z ^ C2|only user 2 is transmitting) ~ ee2 — ee(l ^ £2) + £2(1 ~ fe) 
P{z 7^ (ci ® C2)|both users are transmitting) — ie 

where ie is given as in the previous section. Moreover, for some ^1,^2 G [0, 1], we define the followings, 



P{yi 


— Ijonly user 2 is transmitting) 


= /ti = ei(l- 


^l2) -f 


-M2(l- 


^1) 




~ Ijonly user 1 is transmitting) 


= A2^e2(l- 


Ml) 4 


-Mi(l- 


h) 


P{z 


— Ijonly user 1 is transmitting) 


= /^el = eei(l 


- Ml) 


+ /il(l 


- Cel) 


P{z 


= Ijonly user 2 is transmitting) 


= /Ue2 = ee2(l 


- M2) 


+ M2(1 


- ee2) 


P{z 


— Ijboth users are transmitting) 


= ^ ee(l - 


M12) - 


f Ml2(l 


- Ce), 



where, ei and €2 are given as in the previous section, and /ii2 = — 112) + M2(l ^ Mi)- Using these definitions, 
the following result is obtained. 

Proposition 1: The set of achievable rates for the half-duplex modulo-2 two-way wiretap channel TZ^^^ is given 

by, 

7^^*^ ^ closure of the convex hull of I [j 7^^*^(P) i , 
where 7^^*^ is defined as, 

r""-' ^ {(ei,e2,Mi,M2,Pi,P2) : < ei, £3, Mi, M2, A, ^^2 < 1,}, 
and TZ^^' (P) is the closure of all non-negative rate tuples R2) satisfying 

Ri<Pi{l-P2)iHifi2)-H{e2)) 
R2<P2{l-Pi){H{fLi)-H{h)) 

R1+R2 < Pi{l-P2){H{fi2)-H{e2)) + P2{l-Pi){H{fH)~H{h)) 
~PiP2iH{fie)-H{ee)) 
- {Piil - P2) + Piil - Pi)) 

H{fieidi + He2d2) ~ Q.5H{dieei + d2ee2) - 0.5H(di(l - e^i) + d2ee2. 



where 



, Pl(l-P2) . 

"1 = — -, ^ ; r, and 

Pi{l - P2) + P2{1 - PiY 



d2 = 1 - di . 
Proof: Please refer to Appendix |F] 
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The advantage offered by randomized scheduling is best demonstrated in the following example. First, we observe 
that cooperative binning and channel prefixing scheme with deterministic scheduling fails to achieve a non-zero 
secrecy rate if Eve's channel is not more noisy than the legitimate channels. Now, consider the noiseless case, i.e., 
ei = 62 = ee = 0. By setting /ii = = A = ^2 = 0.5, ci — 0, and £2 — 0.5, Proposition [T] shows that the 
randomized scheduUng approach allows user 1 to achieve a secure rate of Ri — 0.25 — 0.5(1 — H{0.25)) > 0. 

The final step is to specialize the region to the Gaussian channel with half-duplex nodes. Eve is again assumed 
to perfectly identify the no transmission and simultaneous transmission states. We select codewords and jamming 
sequences as Gaussian (with powers and pf, respectively). In addition, to further increase Eve's ambiguity, users 
jointly set (p^ + p2)9ei to the same value pr (assuming the channel knowledge at both users). The following result 
is readily available. 

Proposition 2: The set of achievable rates for the half-duplex Gaussian two-way wiretap channel TZ^'~^ is given 

by, 

7^^G A ^iQgm-g of jhe convex hull of i IJ TZ"^{P)\ 

where 'P^'~^ is defined as, 

-P""" = {(p^,P?,P^,P^,Pl,P2) : < Pl,P2 < l,iPl+Pl)9el = {P'2+P2)9e2 = Pr, 

Pl{pl+p1)<PuP2{p'i+pl)<P2}, 

and TZ^'^{P) is the closure of all non-negative rate tuples (i?i,i?2) satisfying 

i?i< Pi (1-^2)7' 



i?2 <P2(1-Pl)7 



P^2 
1+p^ 



Pi + i?2 < Pl(l - P2)7 ( Yf-n J + ^2(1 - Pl)7 [jf-n ) + ^^1^1,^2) - M^), 



where 



hiZ)^hiZ\C^,C2) = P1P27I /^^,f ^^^^f )+(Pi(l-P2) + P2(l-Pi))^log(27re(l + p.)) 



/>oo />oo 

-(Pl(l-P2)+P2(l-Pl)) / / 

J j— — oo J i- 



fci{i).fc2{j)HZ\i,j)dfc\dfc2, 



dif{z; + pigei) + d2f{z;j, 1 + P29e2), 
Pi(l-P2) 

Pl(l-P2)+P2(l-Pl)' 
1-di, 
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and f{x; ji, a^) is the value at x of the probability density function of a Gaussian random variable with mean /i 
and variance a^. 

We remark that the ambiguity at Eve can be further increased by randomizing the transmit power levels at the 
expense of more receiver complexity (due to the non-coherent nature of the transmissions). We implemented this 
randomization idea in the next section, where the complexity issue is resolved by using energy classifiers. 

IV. Randomization for Secrecy: Practical Implementation 

In this section, we study a more practical half-duplex Gaussian setting where the constant channel coefficients are 
determined by the distance-based path losses in a 2-D geometric model. Our focus will be devoted to the symmetric 
case where the two messages have the same rate. Without any loss of generality, Alice and Bob are assumed to 
be located on the x-axis at opposite ends of the origin and Eve is assumed to be located outside a circle centered 
around the origin of radius te at an angle 6 of the x-axis (see Figure |4|. This key assumption faithfully models 
the spatial separation, between the legitimate nodes and eavesdropper(s), which characterizes near field wireless 
networks like Body Area Networks (BAN) [see e.g. |fT9ll 1. The performance of the proposed secure randomized 
scheduling communication scheme will be obtained as a function of and the distance between Alice and Bob, 
i.e., dAB- In the discrete-time model, the signals received by the three nodes in the t*'* symbol interval are given 
by 

Y,{t) = l{x,(t),o} [GA{dTfx^{t)e-=^''-- + d-/J^X^{t)e~=^^'--) + N,{t) 

Y2{t) - l{x.(t),o} [GB{d-'/J^X,{t)e-'J^''-- + d-^^J^X2{t)e-'^^''--) + N,it) 

Z{t) = GE{d-/J'-X,{t)e-^''''-- +d-s''J^X2{t)e-^''^--)+N,{t), 

where k is the wave number, Ga, Gb and Gb are propagation constants which depend on the receive antenna 
gains, and a is the path loss exponent which will be taken to 2 as in the free space propagation scenario. (One can 
easily extend our results for other scenarios with different path loss exponents.) For further simplicity, we restrict 
ourselves to binary encoding implying that Xi{t) e | — ■\/p(t), 0, where p{t) is the instantaneous signal 

to noise ratio at unit distance in the i*'* symbol interval if Alice decides to transmit. Xiit) = if Alice decides not 
to transmit. The same applies to X2{t). p{t) is selected randomly in the range [pmimPmax], by varying the transmit 
power, according to a distribution that is known a priori to all nodes. The indicator function is defined as 

in Section |lll] In order to ensure the robustness of our results, we assume that Eve employs a large enough receive 
antenna, i.e., Ge » 1, such that her receiver has a high enough SNR and the additive noise effect in Z can 
be ignored. We assume Ga = Gb = ^, and a hard decision decoder at both the legitimate receiver(s) and the 
eavesdropper We consider a memoryless classifier C used by Eve to identify the origin of each received symbol, 
i.e., the decision is based only on the power level of the observed symbol in the current time interval. Here, Pm and 
Pf represent the probability of miss detection and false alarm, respectively. Furthermore, we use Pe\m to denote 
the probability of symbol error given occurrence of the miss detection event. Finally, we use the following notation: 
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The deterministic scheduling paradigm is represented by a Time Division Multiplexing scheme whereby only a 
single message is transmitted in any given time frame, and the legitimate receiver jams the channel with random- 
content feedback symbols at random time intervals. More specifically, the receiver will transmit a feedback symbol 
at any time interval with probability /3. This feedback will result in erroneous outputs at the eavesdropper due to 
its inability to identify the symbols corrupted by the random feedback signal and erasures at the legitimate receiver 
due to the half-duplex constraint. As argued in Q, this scheme is capable of completely impairing Eve in modulo- 
additive channels. In our real-valued channel, however, a simple energy classifier based on the average received 
signal power ||20| can be used by Eve to differentiate between corrupted and non-jammed symbols. To overcome 
this problem, we use pre-determined distributions for the transmit power of both the data symbols, /i, and feedback 
symbols /2. This randomized power allocation strategy is intended to increase the probability of misclassification 
at Eve. The following result characterizes the achievable rate with this scheme. 

Theorem 3: Using the proposed TDM protocol with randomized feedback and power allocation, the following 
secrecy rate is achievable at each user. 

Rs = 0.5 max I min | \Rm ~ -RrI^I 

/3Ji,/2 i 0,C ' ' 

where 

Proof: Please refer to Appendix IgI ■ 
In the randomized scheduling approach, each node will transmit its message during randomly selected time 
intervals, where a single node's transmitter is active in any given time interval with probability Pt, and the transmit 
power level is randomly selected according to the distribution /. Consequently, there are four possible states of both 
transmitters in any particular time interval i. Due to our noiseless assumption, the eavesdropper's antenna will easily 
identify silence intervals. Eve's challenge, however, is to differentiate between the other three states. Let A and B 
represent the transmission event of Alice and Bob, respectively. Similarly, A"^ and i?^ are the complementary events. 
Finally, we let Ei — > E2 to denote the occurrence of event Ei and its classification by Eve as event E2, and denote 
the probability of error given that the event {A, B) was mistaken for (A, B^) by the classifier as Pe\{A,B)-^{A,B'=)- 
The following is the achievable secrecy rate with the two-way randomization approach. 

Theorem 4: Using the two-way randomized scheduling and power allocation protocol, the following secrecy rate 
is achievable at each user 

Rs = max(min([i?ji/ - max(i?B^, Reb)\^)), 

PtJ 9fi 

where 

«„^p.(i-p,)(i-/^(i-*(;^)) 
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Rea^Da\1-H 



' p(EA)- 



( < ^ 

Reb = Db\1-H 



p{EB}- 



^ Db J J 

Da = PtP(A.B)^(A,B'') + -Pt (1 - Pt) P(A<= .B)^(A,B'') + -P* (1 - Pt) (l - P(A,B^)^{A'= ,B) - P(A.B'=)^(A.B)) 
Db = P^P(A^B)^(A-'^B) + Pi (1 - Pt) P(A,B')^(A-'^B) + Pt (1 " Pt) (l " P(A<^,S)^(A,Be) " P(Asi3)^(A,B)) 
Pi^^) = Pt'P(A,B)^(A,S^)Pe|(A,i3)^(A,B^) + O.SP* (1 ~ P*) P(AsS)^(A,i3=) 
Pi^^^ = P^'P(A,B)^(A^B)Pe|(A,S)^(A^B) + O.SP* (1 - P^) P(A,S^)^(A^B) 

and Da, Db represent the portion of symbols classified by Eve as being transmitted by Alice or Bob respectively. 

Proof: Please refer to Appendix iHl ■ 
One can argue that the achievable secrecy rate increases as increases. The reason is that a large te will impair 
Eve's ability to differentiate between the symbols transmitted by Bob and Alice. The following result characterizes 
the secrecy rate achievable in the asymptotic scenario when te » (Iab- 

Corollary 5: Let Pmax be the achievable secrecy rate using the randomized scheduling and power allocation 
scheme when te ^ co. Then, 

P^ax = max([PAf - (1 - (1 - P)')(l - iJ(0.25))]+), (10) 

where 

Pmm 



Rm ^Pt{l~Pt)\l-H[l 
Proof: Please refer to Appendix H] 



A. Numerical Results 

In our numerical examples, we assume a uniform power distribution for both Alice and Bob, and a threshold-based 
energy classifier is used by Eve. Because we assume that all channels are noiseless, Eve can successfully decode the 
received symbols, corresponding to concurrent transmissions, as the symbols with the higher received signal power. 
Also, the received signal powers in all transmission scenarios are known a priori, where a transmission scenario 
is defined by the set of active transmitters and the selected power levels. Based on the received signal power, the 
transmission scenario is detected by Eve, and hence the set of active transmitters. In case two or more transmission 
scenarios result in the same received signal power, a random choice is made with equal probabilities given to all 
possible scenarios. To simplify the calculations, we further assume that Alice and Bob use sufficient error control 
coding to overcome the additive noise effect. More precisely, Alice and Bob are assumed to use asymptotically 
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optimal forward error control coding and that their received SNR is above the minimal level required to achieve 
arbitrarily vanishing probability of error 

Fig. |5] reports the achievable secrecy rate Rs of Theorems [3] and |4] at different values for the distance ratio 

"max 

(rfmin = niin(dA£;, rfsi;), c^max = max(d^£;, (iss)). A few remarks are now in order. 

1) The two-way randomization scheme achieves higher rates than the TDM scheme. The reason is the added 
ambiguity at Eve resulting from the randomization in the scheduling algorithm. 

2) The lower secrecy rates for smaller values of is due to Eve's enhanced ability to capture the symbols 
transmitted by the node closer to her. 

3) The rates plotted in Fig. |5] were found to be very close to those of a classifier that does not erase any received 
symbols, i.e., transmission scenarios corresponding to concurrent transmissions are not considered. 

B. Experimental Results 

We implemented our experiments on TinyOS 1211 using TelosB motes ll22l . which have a built-in CC2420 radio 
module |l23]. The CC2420 module uses the IEEE 802.15.4 standards in the 2.4 GHZ band [24|. Our setup consists 
of four nodes, equivalent to Alice, Bob, Eve, and a Gateway module. The Gateway acts as a link between the 
sensor network and a PC running a Java program. Our experiment is divided into cycles. During each cycle, the PC 
works as an orchestrator, through the Gateway, that determines, using a special message {TRIGGER-MSG), whether 
Alice should send alone. Bob sends alone, or both send concurrently. It also determines the power level used for 
transmission. These decisions are based on the transmission probability Pt- Upon receiving the broadcast TRIGGER- 
MSG, each trusted node transmits a DATA-MSG while Eve will start to continuously read the value in the Received 
Signal Strength Indicator (RSSI) register (the RSSI value read by the CC2420 module is a moving average of the last 
8 received symbols ll23l .). Eve then transfers the RSSI readings from the memory buffer to the Gateway node which 
will forward them to the PC in an RSSTMSG. For each cycle, the Java program stores the received RSSI readings for 
further processing by the energy classifier (implemented in MATLAB). When transmitting data messages {DATA- 
MSG) from Alice or Bob, each node constructs a random payload of 100 bytes using the RandomMlcg component 
of TinyOS, which uses the Park-Miller Minimum Standard Generator Each symbol is 0-QPSK modulated f24j 
representing 4 bits of the data. We also had to remove the CSMA-CA mechanism from the CC2420 driver in order 
to allow both Alice and Bob to transmit concurrently. Finally, it is worth noting that the orchestrator was used to 
overcome the synchronization challenge in our experimental set-up. In practical implementations. Bob (or Alice) 
could start jamming the channel upon receiving the Start of Frame Delimiter (SFD). 

In our implementation of the energy classifier, the discrete nature of the transmit power levels is taken into 
consideration. First, the eavesdropper was given the advantage of having the classifier trained on a set of readings 
taken by running the experiment in the same environment and at the same node locations as those for which the 
classifier would be later used. In the training phase, our classifier is given prior information on the configuration, 
power levels selected for each node, and the measured RSSI readings at each cycle. It then finds the mean and 
variance of the measured RSSI values for each transmitted power level for Alice and Bob when each of them sends 
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alone in a cycle. Any received symbol is classified as being transmitted by either of the communicating nodes. This 
choice is based on our third observation on the rates plotted in Fig. |5] When running the classifier, a maximum 
likelihood rule is employed, where the following expression is evaluated, 

maxi/A,(y) A ^ 
vcL&yiifBXy) B 

and the symbol is classified accordingly, where fx^ (y) is the value of the approximated Gaussian distribution of 
measured RSSI values when source X is the only transmitter with power level i. In a practical implementation, the 
length of a cycle is the duration of a single symbol, and hence, in our setup the classifier bases its decision on a 
single RSSI reading. In evaluating the classifier performance, we use the transmission scenario indicating the actual 
status of the transmitters in each cycle and compare them with the classification results to obtain the probability of 
each possible misclassification event. We also assume that, in case of concurrent transmission. Eve can correctly 
decode the symbol received with the higher signal power, as suggested in f25l. This assumption is used to calculate 
the values of Pe\(A,B)^{A,B':) ™d Pe\{A,B)^{A':,B)- We also use the same set of data to train and run a classifier for 
the TDM protocol described above. Here, we only consider cycles when Alice's transmitter is active, and consider 
Bob's concurrent transmission as jamming. 

Our experiments were conducted in a hallway environment, where only few scatterers exist (only the wall 
structure). We train, run, and evaluate our energy classifier, then use the resulting probabilities in the rate expressions 
of Theorem [3] and Theorem |4] to find the achievable secrecy rates. Figs. |6] and |7] report these results in two 
representative configurations. In the first, Alice and Bob are placed at the same location with (Iae — Abe ~ '^Oft, 
whereas (Iae = 1/i and dsE = "^Oft in the second. We note that the measured difference of received signal 
power values from both transmitting nodes was found to be 2dB and 19dB for Configurations 1 and 2, respectively. 
This implies that the maximum rates in Fig. |7] and Fig. |6] should be compared to the value of Rg in Fig. |5] at 
J™- = 0.79 and 0.11 respectively. We believe that this difference between the theoretical and experimental results 
can be attributed to hardware differences and the deviation of the actual channel from the simplistic free space 
model used in our derivations. More specifically, we observe that the maximum secrecy rates for the two-way 
randomized scheduUng scheme in our experimental results is slightly lower than those calculated numerically. The 
reason is Eve's enhanced ability to distinguish between the two sources of transmission due to the discrete nature 
of the selected transmit power values. Nevertheless, the experimental results establish the ability of our two-way 
randomized scheduling and power allocation scheme to achieve perfect secrecy in practical near field communication 
scenarios where the distance between Eve and legitimate nodes will be larger than the inter-node distance, even if 
Eve is equipped with a very large receive antenna. 

V. Conclusion 

In this paper, we used the cooperative binning and channel prefixing approach to obtain achievable secrecy rates for 
both the discrete memoryless and Gaussian full-duplex two-way wiretap channels. In the proposed scheme, channel 
prefixing is used to create an advantage for the legitimate terminals over the eavesdropper which is transformed 



October 4, 2011 



DRAFT 



19 



by the binning codebooks into a non-trivial secrecy rate region. A private key sharing and encryption was used 
to distribute the secure sum rate between the two users. We then introduced the idea of randomized scheduling 
and established its fundamental role in the half-duplex two-way wiretap channel. Our theoretical analysis revealed 
the ability of the proposed randomization approach to achieve relatively high secure transmission rates under mild 
conditions on the eavesdropper location. The ambiguity introduced at the eavesdropper by randomized scheduling 
was further validated by numerical results and extensive experimental results using IEEE 802.15.4-enabled sensor 
boards in near field communication scenarios. 
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Appendix A 
Proof of Theorem [T] 

First, we fix the probability density function P{q), then generate a sequence q" , where the entries are i.i.d., 
and each entry is randomly chosen according to P{q). The sequence q" is then given to all nodes before the 
communication takes place. 

Codebook Generation: 

Consider user i G {1, 2} that has a secret message Wi £ Aii = {1, 2, Mi}, and a private key £ Aif = 
{1, 2, M/^}. For a given distribution P{ui\q) and the sequence q, generate i.i.d. sequences u" {w"), where 
< e [1, • • • , Af," = 2"'^5']. For each codeword <'«), generate MfM^M°M^ = 2"'(«?+^''+-R°+'R?-^") i.i.d. 
sequences cf , where M, = MIM°Ml', and P(cf'|u"') = nt=i Randomly distribute these into 

double indexed bins, where each bin has M°Mf — 2" +^r-eo) codewords, and is indexed by the tuple (wf , w^), 
e {1, • • • , M/ = 2"'-"? }, < e {1, • • • , M° = 2"'-"' }, and wf € {1, • • • , Mf = 2"'-"^ }. These codewords are 
represented by c" {w^ ^w^.w^ ,w°, wf). 

Encoding: We use a block encoding scheme, where the full message is transmitted over B blocks, each of length 
n', and n = n'B. In the rest of the proof, we use bold face letters to represent vectors of block length n' . In each 
block, each user will transmit a private key in addition to its message, and the other user will use this private key in 
the next block to secure its message fully or in part. We omit the block indices for readability. In any given block, 
user 1 will send the corresponding block messages of wi £ Aii and the randomly selected Wi G A^J . The message 
index (wi) is used to select a tuple {wl,Wi ,w°), where and Wi are encrypted into and w°, respectively, 
using the private key = [w)2^,w)§^] received from the other user in the previous block. In other words, let b", 
b°, b", b°, bj^, and be the binary representations of w", Wi, w", wj, and respectively. Then, 
b" = b" ® 82 and b° = b° 63^. Here, is used to select the cloud center of the super position coding (see, 
e.g., Il26l ). {wfjWi) is used to select the bin index, and the codeword index within the bin is given by {wi,wf), 
where wf is randomly selected according to a uniform distribution. (Note that, due to one time pad, Wi is also 
uniformly distributed.) Thus the corresponding codeword c" {wi ,wf,Wi ,w°,wf) is selected. Then, the channel 
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input, x" , is generated using the distribution P{xi\ci). A similar encoding scheme is employed at user 2. As the 
messages transmitted in different blocks are independent, satisfying the reliability and security constraints for each 
block guarantees their application for all messages transmitted in an arbitrarily large number of blocks. 



if such a tuple exists and is unique. Otherwise, the decoder declares an error. Note that the decoder's estimate W2 
is determined by (wl, W2,W2, Wi ), where Wi is the private key sent by user 1 in the previous block. Decoding at 
receiver 2 is symmetric and can be described by reversing the indices 1 and 2 above. 
Probability of Error Analysis: 

It follows by the proof of the capacity of the point to point DMC lH] that for any given e > 0, receiver 1 can 
decode the corresponding messages with Pe.2 < e for sufficiently large n', if 




R'2 + R2+R2 + R2 < I{C2;Yi\Xi,U2,Q) 
R^ + R'2 + R2+R2 + R2 < IiU2,C2;Yi\Xi,Q) 



(11) 



(12) 



By symmetry, a similar condition applies to receiver 2 to have Pe^i < e, i.e.. 



Rl + R'l + R°, + R^ < I{Ci;Y2\X2,Ui,Q) 



(13) 



R'i + Rl+R'l + RI + R^ < I{Ui,Ci-Y2\X2,Q) 



(14) 



Equivocation Computation: Consider the following argument. 



H{W^,Wl,W^,W^\Z) > H{W^,W^,W^,W^\Z,lJi,V2,Q) 



- H{W^, W^, W^, Z|Ui, U2, Q) - i/(Z|Ui, U2, Q) 



= HiW,^ W^, W^, Ci, C2, Z|Ui, U2, Q) - i?(Z|Ui, U2, Q) 
- H{C,,C2\W1,WI,W!^,W^,Z,\5,,\52, Q) 



= if(Z|Ci, C2, VK^ W(, W^, Wi, Ui, U2, Q) 
+ H{W^,Wl,Wl M^l, Ci, C2IU1, U2, Q) 
- i7(Z|Ui, U2, Q) - H{C,,C2\Wl W^, W^, Wi, Z, Ui, U2, Q) 



[i/(Z|Ci,C2,Ui,U2,Q)-iI(Z|Ui,U2,Q)]+ff(Ci,C2|Ui,U2,Q) 



- HiC,,C2\W^, W^, W^, Wi, Z,Ui,U2, Q) 

> C2; Z\Ui, U2, Q) - n'ei + i7(Ci, C2|Ui,U2, Q) 

- i^(Cl,C2|w^^ wi, w^, Wi, z,Ui,U2, q), 



(15) 
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where (a) follows from the fact that conditioning does not increase the entropy, (b) follows from the fact that, given 
Ui,U2,Q, {W^,Wl,W^,Wi) -> (Ci,C2) ^ (Z) is a Markov Chain, and (c) follows from /(Ci,C2;Z|Ui,U2,Q) 
< n'/(Ci, C2; Z\Ui, U2, Q) + n'ei with ei — >■ as n' — > 00 for a discrete memoryless channel (see, e.g., ||3] Lemma 

8]). 
Here, 

iI(Ci, C2|Ui,U2, Q) = n'iR'l + RI+ R1 + + + R'2 + R° + - 2eo), (16) 

as, given (Ui, U2, Q) = (ui, ua, q), the tuple (Ci, C2) has 2"'(-«^+^i+^?+^^+«2+«2+«2+«2-2eo) possible values 
each with equal probability, and, 

for £2 as n' 00. This follows from the Fano's inequality, as the eavesdropper can decode the randomization 
indices {w°,wf,W2,W2) given (w^ , , , w|) if the following conditions are satisfied. 

Rl + R'^ <I{CuZ\C2,U,,U2,Q) (17) 

R°2 + R^2<I{C2;Z\Ci,Ui,U2,Q) (18) 

R1 + R^^+R° + R^< I{Ci,C2] Z\Ui, C/2, Q) (19) 
By averaging over Wi, Wf, W2, W2, Ui, U2, and Q, we obtain 

H{Ci,C2\W^,W^,W^,W^,Z,V,,V2,Q)<ne2, (20) 

Now, once we set, 

R1 + Rf + R^ + R^^ /(Ci, C2; Z\Ui, U2,Q), (21) 



-H{W^,W^, W^,W^\Z) >R\ + R{ + R^ + R'^- (ei + £2 + 2eo) 

1 ' 



and combine dTsl l. ( fT6l l. ( |20| |. and (l2Tl i. we obtain 
1 

and (ei + £2 + 2eo) ^ as n' — > 00. 

Since (wf ) is used as a private key to secure the part of the message carried in w", w1 {w2,W2, respectively) 
with the one-time-padded scheme, the secrecy constraint 

^H{Wi,W2\Z) > Ri + R2 - e 
n' 

is satisfied (see f2l) if 

R'( + Rl < Rl (22) 
+ < i?f (23) 

where we set Ri = R\ + Rl + Rf and R2 = R'{ + i?^ + 
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Finally, we note that i?" = R2 = Rl = R2 = for the first block. However, the impact of this condition on the 
achievable rate diminishes as the number of blocks B ^ 00. The region achieved by the proposed scheme is given 
by (dB, dll, Gil, O, CI, (O, (EU, and 



Appendix B 
Proof of Theorem [2] 

For a given distribution p E V^, let 

le = IiCuY2\X2,Q) - I{Ci;Z\Q), 
Ir^I{C2;Yi\Xi,Q)-I(C2;Z\Q), 

and 

/g = /(Ci; ^21^2, g) + /(C2; YilXi, g) - /(Ci, C2; Z|Q). 

If /§ < 0, we set Ri = R2 = 0. Hence, we only focus on cases for which /g > 0. This implies that Iq > 
and/or > 0. (As /g < and /y < implies that /g < 0.) We detail the proof for the following cases. 
Case 1: /e > and Ij >0 for the given p e V^. 

We set Ui,U2 as deterministic and i?" — i?2 = in Theorem [T] and obtain that 

Rl + R^^ + RI + R^^ < I{Ci;Y2\X2,Q)=Ii (24) 

Rl + Rl + R°2 + R^2 < I{C2]Yi\Xi,Q) ^ h (25) 

Rl + Rl < I{Ci;Z\C2,Q)^h (26) 

R2+R2 < I{C2]Z\Ci,Q)^h (27) 

Rl + Rl + R°2 + Rl = I{Ci,C2;Z\Q)^ h (28) 

RI < Rl (29) 

R°2 < Ri (30) 

As Iq > 0, Ij > 0, and /g > 0, we can choose the rates as follows: 

. If I{C2;Yi\Xi,Q) > /(C2; Z\Ci,Q), then we choose 

R'l = 0, i?J = Rl, RI = [I{CuC2]Z\Q)-I{C2;Y^\X^,Q)]+, 

RI = I{Ci;Y2\X2,Q) ~ Rl ~ [IiCi.C2; Z\Q) ~ /(C2; Fil^i, g)]+, 

i?| = /(Ci; Z|Q) - [/(Ci, C2; Z|Q) - /(C2; FilXi, Q)]+, i?g = 0, i?i = /(Ci, C2; Z|g) - i?| - 

i?^ = [/(C2; nixi, g) - /(Ci, C2; z|g)]+. 

. If /(C2;Fi|Xi,g) < I{C2;Z\Ci,Q), then we choose 

RI - /(Ci; ^21^2, g)-/(Ci, C2; Z|g)+/(C2; FilXi, g), Rf = /(Ci, C2; Z|g)-i?|, i?i = /(C2; FilXi, g), 
and the remaining rates equal to zero. 
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These choice of non-negative rates satisfy conditions in (I24b-(l30l). and hence we can achieve the rate pair 

= /i - [/5 - /2]+, i?2 = [h - /5] + )- 

Similarly, by reversing the indices above, the rate pair 

(i?l = [/l-/5] + ,i?2=/2-[/5-/l] + ) 

is achievable. Now, combining these two achievable points we obtain the following achievable region: The set of 
non-negative {Ri, R2) pairs satisfying 

^1 < h 
R2 < h 

R1 + R2 < h + h- h 

are achievable. 

Case 2: /g > and /r < for the given p e V^. 

We set Ui and C2 as deterministic and choose the following rates in Theorem [T] (other rates are chosen to be 0). 

i?^ = IiCi;Y2\X2,Q)^IiCi;Z\U2,Q)^Rl 

Rl < I{Ci;Y2\X2,Q)~IiCi;Z\U2,Q) 

i?^ = I{Ci;Z\U2,Q) 

i?2" = min{/(t/2;Yi|Xi, g),i?f} 

For the given p e with Iq > and Ij < 0, the following region is achievable. 

Ri < I{Ci;Y2\X2,Q) 
R2 < /(t/2;ri|Xi,Q) 
R1+R2 < I{Ci-Y2\X2,Q)~I{Ci;Z\U2,Q) 

Note that the above region is the same as the one in the theorem statement, with the random variable U2 taking 
the role of C2. Case 3: /g < and /y > for the given p eV^. 

Reversing the indices everywhere in case 2 above, we obtain the following achievable region 

Ri < I{Ci;Y2\X2,Q) 
R2 < I{C2;Yi\Xi,Q) 
R1 + R2 < IiC2;Yi\Xi,Q)-IiC2;Z\Ci,Q) 
Combining the above cases completes the proof. 

Remark 2: The above scheme either uses the one time padded private key as one of the two selectors for the 
randomization index (Case 1), or does not employ the random binning coding scheme and only uses the private 
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key at one of the user (User 2 in Case 2, and User 1 in Case 3). Hence, no superposition coding is present. We 
should also note that the achievable rates proved above in Cases 2 and 3, can be higher than that of the statement. 
However, as already mentioned, we only use this Theorem as a simple special case of Theorem [T] 

Appendix C 
Proof of Corollary[T] 

We set \Q\ = 1 in Theorem |2] and take the convex hull of the achievable rates. We compute the following terms. 

IiCi;Y2\X2,Q) = H{Y2\X2)-H{Y2\Ci,X2) 

< l~H{e2) (31) 

/(C2;ri|Xi,g) = H{Yi\X^)-H{Y^\C2,Xi) 

< l~H{h) (32) 

I{Ci-Y2\X2,Q) + I{C2;Y^\Xi,Q) - I{Ci,C2]Z\Q) = {H{Yi\Xi) + H{Y2\X2) - H{Z)) 

+ {H{Z\Ci,C2) ~ H{Y^\C2,Xi) - H{Y2\Ci,X2)) 

By noting that, 

H{Yi\Xi) + H{Y2\X2) - H{Z) = {H{X2®Ni) + H{Xi®N2)-H{Xi®X2®N,)) 

H{X2 ® iVi) + H{Xi ® N2) - H{X2 ®Ni®Xi®N2® N^) 

< H{X2 ® iVi) + H{Xi ® N2) - H{X2 (BNi®Xi® N2) 
= H{X2 ® iVi) + H{{X2 ® iVi ® ® N2)\{X2 ® A^i)) 

^H{X2 ® TVi ® Xi ® N2) 
= H{{X2 ® iVi), {X2 ® iVi ® Xi ® N2)) - H{X2 ® iVi ® Xi ® N2) 
= H{{X2®Ni)\{X2(BNi®Xi®N2)) 

< 1 

where (a) follows by setting = Ni (B N2 (B Ne, (b) follows from the fact that conditioning does not increase 
entropy, we conclude that, 

I{Ci;Y2\X2,Q) + /(C2; FilXi, Q) - /(Ci, C2; Z\Q) < 1 + H{e,) - H{h) - Hih), (33) 

The proof is complete by combining the terms in ( [3TT i. ( |32] |. and (|33T l with Theorem |2] We note that equality 
applies in the three mentioned terms when the variables Ci, C2 are drawn from the uniform distribution over {0, 1}. 



October 4, 201 1 



DRAFT 



25 



Appendix D 
The region TZ^'^ includes that of ifTl 



We utilize the time sharing parameter as follows. Let Q — {1,2}, where q — 1 with prob. (1 — a) and q — 2 
with prob. a. The remaining distributions are as follows. 

• For (J = 1, we set Ci as deterministic and Xi = Ni for channel prefixing. C2 and Ni are generated with full 
powers P2 and Pi, respectively. 

• For q 2, we set C2 as deterministic and X2 = N2 for channel prefixing. Ci and N2 are generated with full 
powers Pi and P2, respectively. 

With this choice the region in Theorem |2] reduces to the following: 

Ri < I{Ci;Y2\X2,Q) ^a-f{Pi) 

R2 < I{C2;Yi\Xi,Q) = {l-a)j{P2) 



R1 + R2 < IiCi;Y2\X2,Q) + I{C2;Yi\Xi,Q)-I{Ci,C2;Z\Q) 

9 el Pi 



Let 



aj{Pi) + (1 — a)j{P2) — aj 
Rk = l{P2) - 7 



9e2P2 
l+9elPl 



(1 - a)7 



9e2P2 
1 + 9elPl 



and 



Riia) 



aj{Pi) - 



q;7 



9 el Pi 

1 + 9e2P2 



- (1 - a)RK 



If Rk < 0, then Rl = 7(^1) 



7( 



l + ge2P2 



is achieved by setting a = 1 in the above region. If Rk > 0, then the 



rate Ri (a) is achievable. As Rl — max i?i (a) for Rk > 0, the point [i?, , 0] is achievable. The achievability of 

ae[04] 

[0,i?2] '^^11 tie obtained similarly, and hence, the region of Theorem |2] includes that of lfT3l . 

Appendix E 
Sketch of the Proof of Corollary|4] 

The channel P* {yi,y2, z\xi, X2) with states 4 given to users reduces to the following equivalent channel. 

P{y2,z\xi,X2 =?)1{3^,,7}, for state 1 
P{yi,z\xi =?, a;2)l{j^2,7}, for state 2 
P{z\xi,X2)l{y^7}l{y^7}, for state 3 
I{ai,?}l{2/2,?}1{2,?}' foi" state 4, 
Note that P** {yi,y2, z\xi, X2) is not equivalent to P* {yi,y2, z\xi,X2)- We describe coding scheme for the 
channel P** . The channel P** will be equivalent to P*, if the nodes can classify the state 4 of the channel. 

We first consider the channel between xi and y2 over a block of n' channel uses. There are Pi{l~ P2)n' symbols 
for which the channel is in state 1 (law of large numbers). The symbols for state 2 have 2/2 are deleted. (These 



P**{yi,y2,z\xi,x2) 
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correspond to symbols that have xi —7.) The symbols corresponding to state 3 of the channel can be modeled 
as random erasures. (There are PiP2n' such symbols with high probability as n' gets large.) Finally, the channel 
outputs corresponding to state 4 will be erased (as there is no transmission from user 1). Therefore we consider 
coding over [Pi(l — P2) + PiP2\n' symbols between xi and y2, for which PiP2n' symbols are erasures (as n' 
gets large). 

We first define the followings. 

m = Pi(i-P2K 

"2 = {l-Pi)P2n' 
nz = Pi Pan' 

= (1-Pi)(l-P2)n' 

In the codebook design, we generate 2" (^^i+^i+^i+^i) codewords denoted by c"^^"^ of length 711+713. For each 
symbol time, with probability (1 — Pi) we input xi =? (no transmission event), and with probability Pi we generate 
the channel input xi according to P(a;i|ci) using the next symbol in c"^^"'^. If there is no remaining symbols in 
c"^^"\ we input xi (the effect of this diminishes as n' gets large). Similarly, we generate 2" (^2+^2+-R2+^2) 
codewords denoted by Cj^^"^ of length n2 + 773, and map it to X2 . 

For the decodability, the typical set decoding is employed. For example, the decoder 2 will select (lyf , , wj, ) 
such that, 

(q"',cr+"^(7«^7«^7/;?,K),y^'^+"^') G (state 1). 

Here, the remaining symbols in are deleted as they are equal to ?. The equivalent channel is the random 
mapping of c"^ to x"^"^"^, from which 773 symbols are randomly erased and the remaining ones generate yj^. 
Here the error probability (averaged over the ensemble) can be made small, if 

R'l + Rl + RI + R'l < ^/(Ci; ^2 1^2, g, state 1) (34) 

77' 

R^2+R2 + R°2 + Rl < ^/(C2;Yi|Xi,g,state 2) (35) 

77' 

To show that the secrecy constraint is satisfied, we follow the steps similar to that of Appendix lAl Due to key 
sharing it suffices to show 

^H{W^,Wl,W^,W^\Z"') > R'l + Rl + r!^ + R'2 - e, 
for sufficiently large 77', together with 

i?? < R^, and (36) 
R^ < R\. (37) 

Here, the latter is used to ensure that there are sufficient number of key bits (from the previous block) to secure 
messages that are carried in the open part (of the current block), and the former is satisfied (from the equivocation 
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computation provided in Appendix [All if the rates satisfy the followings. 

Ri+Rf < ^^ii^/(Ci;Z|C2,state 1 or2) + ^/(Ci;Z|C2,state 3) (38) 
n n 

R2+R2 < +/'^ /(c.^;Z|Ci, state 1 or2) + ^/(C2;Z|Ci,state 3) (39) 
n' n' 

R°i + Rf + R°n + R^ = ^^i^i-^/(Ci,C2;Z|state 1 or2) + ^/(Ci,C2;Z|state3), (40) 

n' n' 

Then the region obtained by equations ( |34] |. ( l35T l. (|36] |. (|37] |. (l38l l. ( [39] l. and (|40] | can be simplified (using the 

same steps given in Appendix IbIi to obtain the stated result. 

Appendix F 
Proof of Proposition[T] 

The proof follows by Corollary |4] where we set |Q| = 1 and compute the followings. 

/(Ci; ^2 1X2, g, state 1) = H{fL2)-H{e2) 
/(C2;Yi|Xi,g,state2) = H{fL^) - H{h) 
and the eavesdropper's observed information is given by, 
/(Ci,C2;Z|state 3) - Hifi,)~H{i,) 
/(Ci,C2;Z|state 1 or 2) = {H{^^idi + ^1^2(^2) - 0-5H{die^i + d2e^2) - 0.5H{di{l - e,i) + d2ee2)) , 
where the last equality is a direct results of the following computation. 



H{Z\Ci 


= 0,C2 


= 0) 


= H{dieei 


+ d2ee2) 


H{Z\Ci 


= l,C2 


= 1) 


= H{Z\C\ 


= 0, C2 = 0) 


H{Z\Ci 


= l,C2 


= 0) 


= H{di{l- 


- eel) + d2ee2) 


H{Z\Ci 


= 0,C2 


= 1) 


= H{Z\C\ 


= 1,^2=0) 



Appendix G 
Proof of Theorem[3] 

Consider the time intervals when Alice is transmitting codewords to Bob. Let aM, ctE denote the fraction of 
symbols erased at Bob and Eve, and Pe'*^\ Pi^^ denote the probability of erroneously decoding a received symbol 
given that it was not erased at Bob and Eve, respectively. By applying the appropriate random binning scheme O, 
the following secrecy rate is achievable ( JS], Theorem 3). 

R = max{[I{X;Y) - I{X;Z)] + } , 

where X denotes the input, Y and Z denote the outputs at Bob and Eve, respectively. Considering the transition 
model for this channel, we see 

H{Y\X) = HiaM) + (1 - aM)HiPj''^). 
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Now, let Pr{X(i) = ^/p{^} = H and Pr{X(i) = -^/p{F)} = 1 - H. Then, 

H(Y) = Hiau) + (1 - aM)H{Il{l - Pe^'"^) + (1 - n)Pe^*'^), 
and maxn H{Y) = H{aM) + (1 — Q;m) when 11 = 0.5. This results in 

maxJ(X;y) = inscK{H{Y) - H{Y\X)) = {1 - aM)0- - H{Pj^'^"')) 

P{x) P{x) 

Similarly, max J(X; Z) = {1 - ais)(l - i?(Pi^^)). 

P{x) 

Following the half-duplex assumption, all data symbols transmitted during the same time interval of a feedback 
transmission will be considered as erasures at the legitimate receiver's channel. Therefore, as the frame length 
T — >^ 00, au = /3. For the rest of the symbols, the probability of symbol error by the hard decision detector will 
be 




{t) = l- 

On the other hand, feedback transmissions will introduce decoding errors at Eve. Noting that 1 — Pm of those 
corrupted symbols will be detected by the energy classifier, we get 

as = - Pm) + (1 - P)Pf 
1-aE ' 

Combining these results, we obtain 



max/(X;r) = (1 - ^) - if (^i ^ j 



> (1-/3) 1 



Pa 



— Pm 

and denoting Re = {1 - aE){l - iI(Pi^^)), we have max/(X; Z) = Re, and 

P{x) 

R = max{[I{X;Y) - I{X; Z)]+) > [max/(X; y) - max/(X; Z)]+ > [Rm - Re]^ ■ 

P(x) Pi^) 

Finally, we consider a max-min strategy whereby the legitimate receiver assumes that the eavesdropper chooses its 
position around the perimeter of the circle and the energy classifier's mechanism C to minimize the secrecy rate 
Rg. Accordingly, the legitimate receiver determines the probabiUty of random feedback transmission j3 and both 
the data and feedback signal power distributions /i and /2 to maximize this worst case value (note that the rate is 
scaled by 0.5 to account for the time division between the two nodes). We obtain 

Rs = 0.5 max < mini? 
/3,/i,/2 1 e,c 
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Appendix H 
Proof of Theorem|4] 

Due to symmetry, we only consider the secrecy rate of Alice's message to Bob. Following the previous proof, 
we have the following achievable secrecy rate, 

R = [(l-aM)(l-ff(Pe<*'^))-(l-aij)(l-i?(Pe<^^))] + , 

where aM, otE denote the fraction of symbols erased at Bob and Eve, and Pj-'^^\ Pi^^ denote the probability of 
erroneously decoding a received symbol given that it was not erased at Bob and Eve, respectively. Using half-duplex 
antennas, each node will be able to decode a symbol transmitted by the other node only when its own transmitter 
is idle and the other node's transmitter is active. These two conditions are simultaneously satisfied with probability 
Pt{l- Pt) yielding a a/ = 1 - Ft(l - ^'t)- We also see that 

The symbols classified by Eve as being transmitted by Alice can belong to one of three categories. The first, which 
takes place with probabiHty Pt (1 — Pt) (l — P(a.B'')^(A'= .b) ~ P(a,B'=)^(a,b))^ represents the portion successfully 
detected and correctly decoded by Eve. The second corresponds to symbols transmitted by Bob and misclassified 
as belonging to Alice; with probability Pt (1 — Pt) P{A'=.b)~^{a,B'=)- Those symbols are independent from the ones 
transmitted by Alice, and hence, have a probabiUty 0.5 of being different. The third category, with probability 
PtP{A,B)^{A.B<:)^ corresponds to concurrent transmissions that are not erasedhy Eve's classifier and misclassified 
as Alice's symbols. The probabihty of error in these symbols is denoted by Pe\(A,B)^{A,B':)- Combining these, we 
get 

a_B = 1 - Da 




p{E) ^ 



Pc 



(EA) 



R = 



> 



(1 - aM)(l - i/(Pe^"'))) - (1 - o^e) (l-H (Pi^ 

Pt{i-Pt) (i-h(\-, 



-Da\1-H 



uiEA) - 

Da 



n + 



And the same result apphes to the secrecy rate of Bob's message to Eve by using, 

aE = 1- Db 



P^J 



Pc 



(EB) 



1- aE 

Finally, in order to achieve symmetric secure communication, we set both rates to the minimum of achievable 
secrecy rates for the two nodes. We follow the same min-max strategy as given in the proof of Theorem|3]to obtain 
the lower bound on 
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Appendix I 
Proof of Corollary [5] 

By ignoring the noise effect at Eve, symbols where both transmitters are active will be correctly decoded at 
Eve as the symbol with the highest transmit power Hence, with no prior information regarding the source of any 
transmitted symbol. Eve will not erase any symbol, i.e. E2 £ {{A, B'^), {A'^, B)}. Moreover, Pei^E2 — 0.5 for all 
six possible combinations of Ei and E2, Pe| (a, b)-*- £2=0.25 for the two possible values of i?2. By applying those 
values, we get: 

Rea = Reb = Pt{l - 0.5Pt)(l - H{Q.2b)) 

These values are achieved by employing a symmetric real-time detector at Eve, i.e. Rea — Reb, and each symbol 
has to be decoded as being transmitted either by Alice or Bob. However, Eve may choose to maximize the value 
msx{REA, Reb) by either maximizing only one of those values at the cost of minimizing the other, or by allowing 
its decoder to match the same symbol to different sources, e.g., let PEi^iA.B") = 1 for possible values of Ei, 
then, 

note that Pe\(Ei^{A,B':)) remains the same. By applying the resulting probabilities in the last example, we get the 
rate in (fTOb . It is obvious that by symmetry, having E2 — (A*^, B) for all symbols results in the same rate. 
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Fig. 1. Boundaries of achievable rate regions for the modulo-2 channel, when ei = 0.2, 62 = 0.3, €e = 0.25, and fii = p,2 = 0.5. The 
outer bound is the capacity of the two-way channel without the secrecy constraints. 



October 4, 2011 



DRAFT 



32 




Fig. 2. Boundaries of aciiievable rate regions for the Gaussian cliannel, wlien gn = §22 = 1, Qei = 10, ge2 = 0.1, and pi = 1, P2 = 100. 
Tlie outer bound is tlie capacity of tlie two-way channel without the secrecy constraints. 




Fig. 3. Boundaries of achievable rate regions for the Gaussian channel, when gn = 922 = 1, gel = 5, ge2 = 0.1, and p\ = p2 = 1. The 
outer bound is the capacity of the two-way channel without the secrecy constraints. 




Fig. 4. Near field wireless communications scenario. Eve is assumed to be located outside a circle of radius te whose center lies at the 
mid-point between Alice and Bob. 
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Fig. 5. Maximum achievable secrecy rate for different distance ratios between Eve and each of the two communicating nodes. 
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Fig. 6. /3 vs. Rs in different configurations for the one way TDM scheme, Rb = 0.5[i?A/ — Re]^- We consider the case when Alice is the 
transmitter and Bob is the legitimate receiver. 
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Fig. 7. Pt vs. Rs in different configurations for the randomized scheduling communication scheme, Rs = [RM-max(REA,REBy\ 
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